from __future__ import annotations


class SafetyGuardrails:
    DISALLOWED_PATTERNS = (
        "rm -rf /",
        "shutdown",
        "systemctl stop",
        "mkfs",
        "del /f /s /q",
        "format ",
    )
    ALLOWED_PREFIXES = (
        "pytest",
        "python",
        "pip",
        "ruff",
        "mypy",
        "bandit",
        "npm",
        "pnpm",
        "uv",
        "git diff",
        "git apply",
        "git worktree",
        "git status",
        "git rev-parse",
        "git ls-files",
    )

    def validate_shell_command(self, command: str) -> dict[str, str | bool]:
        normalized = command.strip().lower()
        if any(pattern in normalized for pattern in self.DISALLOWED_PATTERNS):
            return {"allowed": False, "reason": f"Command blocked by safety guardrails: {command}"}

        if normalized.startswith(self.ALLOWED_PREFIXES):
            return {"allowed": True, "reason": ""}

        head = normalized.split(maxsplit=1)[0] if normalized else ""
        if head in {"python", "pytest", "npm", "pnpm", "uv", "pip", "git", "ruff", "mypy", "bandit"}:
            return {"allowed": True, "reason": ""}

        return {"allowed": False, "reason": f"Command is not in the allowed execution list: {command}"}
